As Google sets burial date for legacy Chrome Extensions, fears for ad-blockers grow Google this month said Chrome browser extensions written under its Manifest V2 specification will stop working in January 2023. Thereafter, only Manifest V3 extensions will be supported in Chrome, a change that critics fear will hobble the add-ons and make them little more than toys. "Years in the making, Manifest V3 is more …
Title says it all, but really it shouldn't come as a surprise to anybody that a global ad flinger revises their browser in such a way that it will no longer be able to offer the same degree of privacy and content blocking that users deserve, as said privacy and blocking invariably blocks the crap that they get paid to fling.
What's sad is how many others are going along with this.
Various extension developers have said this is going to be a problem.
Now the consumers of extensions need to say what red lines they're looking at.
For me, breaking NoScript or AdblockPlus means I close Chrome till they work again. And switch to whatever browser those continue to work in.
I'm in the process of switching from Firefox to Chrome/Chromium, since the new version of Firefox they introduced in the summer broke all sorts of things for me. It can't display statements from my bank or payslips from work, for example, and it crashes on me at least once a day.
And who thought it would be a good idea to have a browser update itself in the background and then insist on a restart (actually a shutdown as you have to restart it yourself) with no opportunity to save work in open tabs?
Firefox was great when they cut memory usage and fixed the leaks about five (?) years ago, but it's a trainwreck now.
I have a lot to complain about Firefox choices myself, but why they chose this default is so easy to explain I wonder why I'm having to.
Computer-illiterate people never look into Settings (even if they know such a feature exists). For their own security, updates need to be as automatic as possible, constantly asking would only result in constant uninformed refusals ("WTF, leave me alone already!"). No, this is not an assumption, this is an observation.
Computer literate people on the other hand, the ones needing/wanting more control, have usually heard about those legendary "Settings" menus, and will thus stumble upon the possibility to remove the training wheels. It's there, for them.
(Didn't downvote you though.)
"since the new version of Firefox they introduced in the summer broke all sorts of things for me."
I've noticed similar in Pale Moon. Sites and pages that were working fine in the spring suddenly started crapping-out around mid-summer. I get lots of blank white pages now, and have to resort to Chrome to get some things done. Bleh. Too bad the Web lost its original promise of universality. I guess precise pixel placement trumps all else. Fucking marketing departments...
"what red lines they're looking at"
Three simple things.
1, block all content that isn't approved (scripts, images over a certain size, pop-ups)
2, auto-delete all unapproved cookies after 120 seconds
3, completely block all requests to domains known to serve up nothing worthwhile (doubleclick, facebook, fbcdn...).
You wouldn't let a complete stranger into your home, to insert a USB key into your computer, to run the software of their choosing on your machine. So why the hell does everybody seem to think it's okay to do this "in a browser". If the script offers me benefit, then it (and it alone) can run. Otherwise, GTFO.
I like Firefox's persistent cookie container idea - I suspect its more workable than Brave's more aggressive stance, but Brave is my daily driver. I'm always appalled at the internet when I see it in chrome.
I think Google may have miscalculated here. They will make themselves a stink in the nostrils of all techies. I wouldn't be surprised if corporate desktops switch to Edge and (Firefox or Brave). If techies can't make Chrome palatable for themselves, they are going to be constantly telling people, "I don't use Chrome". Techies may not hold budgets, but they do have influence.
"They will make themselves a stink in the nostrils of all techies."
Google? The same Google that forced all of us to implement https on our sites whether they needed it or not? The same Google that jerks around security standards because it suits their interests? The same Google that's threatening to turn on 2FA for crap like YouTube just because they can? Nah, the techies love dealing with that shit.
There is no magic bullet for privacy. It takes work.
I swapped my daily driver browser to Brave in March then set up a Pi-hole server on a RaspPi for my home network. Very few ads are seen any more and there isn't a single extension involved. If a web site insists I turn off my ad blocker to see their content, I don't go back there again. There's always other options.
When asked to provide an email by web sites I give them my spam account. I log into it, get the info I need, then log off. They can send as much crap as they like to that account and my real InBox is tiny as a result. Once a month, I review the spam list then delete the dross. I use fake names, gender, dates of birth and false identifying info online (unless it is an official government website, of course.)
I also use browser isolation (Gmail in Chrome only), DNS is 9.9.9.9 and my search engine is Duck Duck Go. Every tab is incognito. When I reboot, everything is cleared. I use multiple VM's, renaming them and generating new MAC addresses weekly. Windows telemetry only works if you actually use Windows.
They can monetize my data, but anything linked to me online today is pure garbage.
You don't have a business.
The fact that Chrome is pretty much it for browsers (I use Firefox, and have written an extension for same) means that if you are writing extensions for it, and it is your livelihood, you are going to get screwed, maybe not tomorrow, but soon, and for the rest of your life. (I don't code for a living, as my coding is ugly enough to give Tardigraves cancer)
Linux devs don't have to wonder; unless they keep up to date with the dependencies, their programs break with the next version of each distro. There was a time where you couldn't compile Samba from source on RHEL7 because of a missing library that had been marked as "deprecated" and "WONTFIX" by Red Hat. Samba!
People need to understand that web browsing is just an addon to the Google Apps interface.
You should probably only use Chrome for Gmail, Docs, Drive and other Google services and that's it.
They bank on users being lazy and staying within their app viewer to browse internet.
V3 cripples it enough that people have already given up hope when V3.1 kills it.
Google has been plotting the same demise for many Android features that threaten advertising, spying, and cloud revenue. Android 11 is a dumpster fire and Android 12 is shaping up to be so bad that I wouldn't use it at all.
... but rather a HOSTS file which routes hundreds of ad servers to 0.0.0.0.
Works great. About to translate the thing to use on Linux and Android. I have to wonder how much of the OS that's going to kill, but I do have a couple of sacrificial devices to try it out on.
Happy days.
Oh, and by the way, Hell is full and ad executives are walking the earth.
It took some finagling on my setup, but my ubiquiti stack has a Pi-hole next to it, and I have a secondary Pi-hole sitting on elsewhere on the network in case the first one dies (again.)
I'm honestly more surprised that Ubiquiti doesn't offer it as an option in the cloud key.
I didn't downvote, but as soon as there's an article about ads, you get a million replies along the lines of "what are ads? I use an ad blocker". Ha ha most droll.
Telling people you use an ad-blocker, or a pi-hole is not advice on a tech site like this, it's a misguided form of gloating.
What next? On an article about keyboards, posts from people saying they can type with more than 2 fingers?
An artcile on password security, posts from people saying they never give their paswords to random emails, and that they always use passwords at least 3 characters long?
I use NextDNS (through DNS-over-TLS) via my router as a backstop for blocking and redirect all traffic on port 53. It's quite good. I also have additional blocking on the router itself via adblock on OpenWRT, and only a third of DNS queries actually get through to NextDNS in the first place, meaning that I manage to stay on their free (300,000 queries a month) tier. (#notsponsored) Of course, I also use uBlock0, DDG Privacy Essentials, Privacy Badger, NoScript, ClearURLs, and Decentraleyes, but then maybe I'm paranoid.
Hubert Cumberdale,
"... but then maybe I'm paranoid"
No ... you are not !!!
You qualify as 'Reasonably Cautious' ... in the wild wild west known as the 'Interwebs' :) :)
Keep up the good work !!!
P.S.
As well as all the 'usual' browser addons as you have mentioned, I run unbound to have my own 'controlled' DNS server and multiple separate versions of Diversion / Skynet running on ASUS routers. I also block whole country-level IP-ranges from countries I will not ever access. i.e. China, Iran etc etc
For more information on Diversion / Skynet etc on ASUS Routers running asuswrt-merlin.
[Shameless Plug for 'Excellent' firmware/scripts etc I use .... none my own work :) !!!]
(See https://www.snbforums.com/forums/asuswrt-merlin-addons.60/ )
Even if they ever did, is there anyone that even remotely believes that Google has good intentions when they change things ? Google is a money making machine. All they care about is lining their pockets. They do not care about privacy, safety, health or anything else if it doesn't generate more income. And as they own the space they can pretty much do whatever they like. They own the users. There are no meaningful alternatives to Google left.
And there's nothing the EFF or anybody else can do about it.
There is a tiny silver linig to all this - Google folks seem to have learnt from their Rockefellers to keep token competition alive (indeed Firefox gets its development money from preinstalled prefered search engine) so as to be able to defend against accusations of monopolistic practice. They have a real business need to keep alternatives alive and the three second's worth of revenue lost on this front doesn't seem to hurt them all that much.
i wish someone make a browser like firefox, without google influence, for a subscription - say, $5 a month - just like anyone using vpn, instead of tracking me to the end of the world and sell my path away. i am a software developer myself and i prefer to pay for the effort of the developers rather than let my web access profile sold to third parties that i would rather not to. but maybe our profiles are too valuable that they cannot set a reasonable price tag on their browser to justify the whole thing.
just my wish.
It used to be called Opera v12 ... sadly missed. I paid for the earlier version (7?) Not sure when a decent browser will exist that can't be fingered by Google - even the natural successor to it, Vivaldi, is Chromium based ... And as someone else said, Firefox is rapidly sinking in many ways ...
First they came for browser plugins (NPAPI), then the browser extension system in Firefox (XUL), then WebExtensions v1, and now it seems that v2 will be taken behind the barn for its final earth-bound performance.
What irks me the most about these developments is how much it assumes that browser users are either morons or sheep (or both). While it's definitely true that by making APIs more powerful they also comes with more responsibility, there are in fact a lot of endusers who are not complete morons.
Most of us survived the days with NPAPI-based plugins and even ActiveX-based plugins without as much as a scratch. And then there were those who managed to install every useless plugin that came with a CD in the mail. These same people will happily find other ways to have their system used in botnets and their personal data exploited. Often by filling in phishing forms and other forms of social engineering.
Fact of the matter is that none of this is about protecting user privacy, or protecting them. This is only about restricting what a user (slash sheep slash victim) is allowed to do, and with it developers.
If Google truly gave a damn about security and privacy, they'd take a good hard look at the security flaws in their JavaScript engine that allows for such fun things like snooping on other browser tabs or even outright escape the JS 'sandbox' (more of a sieve these days). Who even trusts running random JS from the Web on their system these days? You'd have to be an idiot or blissfully ignorant to allow that.
Part of me is happy that there are NPAPI & XUL-enabled alternatives to Chrome (and modern Firefox), in the form of browsers like Pale Moon, Basilisk and kin. If I'm going to be shooting myself in the foot, I want to be the one who chose to do it through my own idiocy and not because of someone else's poor judgement.
Elledan,
"If I'm going to be shooting myself in the foot, I want to be the one who chose to do it through my own idiocy and not because of someone else's poor judgement."
I would much rather forgo the whole 'Foot shooting' part, if possible, and hope to obviate the 'idiocy' problem by educating myself on what I need to know/avoid/etc.
Of course, education is a full time ongoing requirement as the ground keeps shifting either by the 'Bad guys!!??' getting cleverer or the 'Good Guys !!??' trying more and more good ideas that won't impact their profit/money stream :)
For really bad sites (at times that seems like 90% of them!! ) I use a Linux Live CD (or DVD) running in a VM with no other storage. Whenever the VM is closed (virtual power off) all the downloaded crap is discarded with no damage to the system it is running on.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
